Gitea before version 1.27.0 contains a security flaw (CVE-2026-58439) in its pull request review process. Specifically, the 'official' approval flag granted to a pull request review is not reset or re-evaluated if the PR's target branch is changed. An attacker with write permissions can exploit this by obtaining an official approval on a PR targeting an unprotected branch, then retargeting the PR to a protected branch. This bypasses branch protection rules, allowing the PR to be merged without proper maintainer approval. The vulnerability is classified under CWE-863 (Incorrect Authorization).

An attacker with write access can bypass branch protection mechanisms by exploiting the stale 'official' approval flag when retargeting pull requests. This can lead to unauthorized code merges into protected branches, potentially compromising the integrity of the codebase. The CVSS v3.1 score is 8.1 (high severity), indicating a significant impact on integrity and availability without requiring user interaction.

A patch is available that addresses this vulnerability by ensuring the 'official' approval flag is properly re-evaluated when a pull request's target branch is changed. Users should upgrade to Gitea version 1.27.0 or later to remediate this issue. No additional mitigation steps are indicated.